Extend metainfo.yaml files with License Information

[Harald Sitter]

On Mon, Aug 17, 2020 at 2:16 PM Andreas Cord-Landwehr
<cordlandwehr at kde.org> wrote:
>
> Hi, I am currently looking into extending our metainfo.yaml files to provide
> information about the outbound licenses of the artefacts that are provided by
> a framework. Here a few examples:
>
> Attica: Provides libattica, which is legally OK to be used as LGPL-2.1 or
> LGPL-3.0 (and of course also as GPL-2.0 or GPL-3.0).
>
> Baloo, which is quite complicated: The library is (supposed to be; there are a
> few license issues here at the moment) LGPL-2.1 and may also be used as
> LGPL-3.0. Moreover, there is the baloo-kioslave that is GPL, then there are a
> few tools balooctl, balooshow and baloosearch, which are all GPL-2.0 or
> GPL-3.0.
>
> **First question:** Shall we only list ONE or ALL licenses, same for the
> license information overview that should be on api.kde.org?

The primary use would be api.kde.org, no? A third party looks for a
solution to hardware shenanigans with Qt and finds the solid docs and
the solid docs say "you may use this thingy under LGPL-2.1". If so,
then surely we ought to encode all artifacts and their licensing
terms. What's more,. the artifact a given class belongs to becomes
relevant and I guess that's a bit tricky to sort out.

> Now, I am wondering about the best approach to encode something like this into
> the metainfo.yaml. I am currently considering a structure as follows:
>
> Attica's metainfo.yaml
> [...]
> outboundLicenses:
>     libattica:
>         - LGPL-2.1-only
>         - LGPL-3.0-only
>
> Baloo's metainfo.yaml
> [...]
> outboundLicenses:
>     libbaloo:
>         - LGPL-2.1-only
>         - LGPL-3.0-only
>     baloo-kioslave:
>         - GPL-2.0-only

Why not actually use a SPDX expression? `LGPL-2.1-only OR LGPL-3.0-only`.

Some additional concerns that come to mind:
- what 's the actual artifact name? for libraries we already have a
target name so I guess we might just use that so for example that'd be
KF5::Baloo. What about plugins or binaries though?
- how would we make sure all artifacts are encoded? do we want to even?

HS